在CDH集群启用Kerberos

KDC服务安装及配置

---

本文档中将KDC服务安装在Cloudera Manager Server所在服务器上（KDC服务可根据自己需要安装在其他服务器）

1.在Cloudera Manager服务器上安装KDC服务

[root@server01 /]# yum -y install krb5-server krb5-libs krb5-auth-dialog krb5-workstation

image.png

2.修改/etc/krb5.conf配置

# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = ALADING.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = false
# default_realm = EXAMPLE.COM
 default_ccache_name = KEYRING:persistent:%{uid}

[realms]
 ALADING.COM = {
  kdc = server01
  admin_server = server01
 }
# EXAMPLE.COM = {
#  kdc = kerberos.example.com
#  admin_server = kerberos.example.com
# }

[domain_realm]
 .alading.com = ALADING.COM
 alading.com = ALADING.COM
# .example.com = EXAMPLE.COM
# example.com = EXAMPLE.COM

红色为修改部分：

3.修改/var/kerberos/krb5kdc/kdc.conf配置

[root@server01 /]# vi /var/kerberos/krb5kdc/kdc.conf
[kdcdefaults]
 kdc_ports = 88
 kdc_tcp_ports = 88

[realms]
 ALADING.COM = {
  #master_key_type = aes256-cts
  acl_file = /var/kerberos/krb5kdc/kadm5.acl
  dict_file = /usr/share/dict/words
  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
  supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
 }

红色为修改部分：

4. 配置acl文件

vim /var/kerberos/krb5kdc/kadm5.acl 
*/[email protected] *

5. 以上3个文件拷贝到集群中其他服务器。

需要同步的文件：
krb5.conf
kdc.conf
kadm5.acl 

下载jce替换ocal_policy.jar and US_export_policy.jar 文件

http://www.oracle.com/technetwork/java/javase/downloads/jce-6-download-429243.html
下载完毕后，解压得到的如下.jar拷贝到java_home/jre/lib/security/文件目录下：

[root@server01 UnlimitedJCEPolicyJDK8]# ll
total 16
-rw-rw-r-- 1 root root 3035 Dec 21  2013 local_policy.jar
-rw-r--r-- 1 root root 7323 Dec 21  2013 README.txt
-rw-rw-r-- 1 root root 3023 Dec 21  2013 US_export_policy.jar

# 同步到所有服务器的JDK8目录下：
[root@server01 UnlimitedJCEPolicyJDK8]#  cp /root/UnlimitedJCEPolicyJDK8/*.jar /usr/java/default/jre/lib/security/

6.创建Kerberos数据库

[root@server01 /]# kdb5_util create -r ALADING.COM -s 
Loading random data
Initializing database '/var/kerberos/krb5kdc/principal' for realm 'ALADING.COM',
master key name 'K/[email protected]'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key: 
Re-enter KDC database master key to verify: 

7. 添加新的管理员用户

[root@ip-172-31-6-148 ~]# kadmin.local
Authenticating as principal admin/[email protected] with password.
kadmin.local:  addprinc admin/[email protected]
WARNING: no policy specified for admin/[email protected]; defaulting to no policy
Enter password for principal "admin/[email protected]": 
Re-enter password for principal "admin/[email protected]": 
Principal "admin/[email protected]" created.
kadmin.local:  exit


# 列出所有的principle
kadmin.local:  listprincs
K/[email protected]
debugo/[email protected]
kadmin/[email protected]
kadmin/[email protected]
kadmin/[email protected]
krbtgt/[email protected]

# 查看principle：getprinc debugo/[email protected]
# 删除principle：delprinc debugo/[email protected]
# 修改principle密码：cpw,change_passwd

8. 启动服务

[root@server01 /]# chkconfig krb5kdc on
[root@server01 /]# chkconfig kadmin on
[root@server01 /]# service krb5kdc restart
Starting Kerberos 5 KDC:                         [  OK  ]
[root@server01 /]#  service kadmin restart
Starting Kerberos 5 Admin Server:                [  OK  ]

9. 验证Kerveros管理员账号

> kinit admin/[email protected]
Password for admin/[email protected]: 
> klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: debugo/[email protected]

Valid starting     Expires            Service principalna jiu
/08/14 11:58:00  09/09/14 11:58:00  krbtgt/[email protected]
    renew until 09/08/14 11:58:00

CDH集群启用Kerberos

---

1. 在KDC中给Cloudera Manager添加管理员账号

[root@ip-172-31-6-148 cdh-shell-bak]# kadmin.local
Authenticating as principal admin/[email protected] with password.
kadmin.local:  addprinc cloudera-scm/[email protected]
WARNING: no policy specified for cloudera-scm/[email protected]; defaulting to no policy
Enter password for principal "cloudera-scm/[email protected]": 
Re-enter password for principal "cloudera-scm/[email protected]": 
Principal "cloudera-scm/[email protected]" created.
kadmin.local:  exit
[root@ip-172-31-6-148 cdh-shell-bak]# 

2.进入Cloudera Manager的“管理”-> “安全”界面

3.选择“启用Kerberos”，进入如下界面

确保如下列出的所有检查项都已完成

4.点击“继续”，配置相关的KDC信息，包括类型、KDC服务器、KDC Realm、加密类型以及待创建的Service Principal（hdfs，yarn,，hbase，hive等）的更新生命期等

5.点击“继续”

6.不建议让Cloudera Manager来管理krb5.conf, 点击“继续”

7.输入Cloudera Manager的Kerbers管理员账号，必须和之前创建的账号一致，点击“继续”

8.等待启用Kerberos完成，点击“继续”

9.点击“继续”

10.勾选重启集群，点击“继续”

11.等待集群重启成功，点击“继续”

至此已成功启用Kerberos。

Kerberos使用

---

使用fayson用户运行MapReduce任务及操作Hive，需要在集群所有节点创建fayson用户。

1.使用kadmin创建一个fayson的principal

[root@ip-172-31-6-148 cdh-shell-bak]# kadmin.local
Authenticating as principal admin/[email protected] with password.
kadmin.local:  addprinc [email protected]
WARNING: no policy specified for [email protected]; defaulting to no policy
Enter password for principal "[email protected]":
Re-enter password for principal "[email protected]":
Principal "[email protected]" created.
kadmin.local:  exit
[root@ip-172-31-6-148 cdh-shell-bak]#

2.使用fayson用户登录Kerberos

[root@ip-172-31-6-148 cdh-shell-bak]# kdestroy
[root@ip-172-31-6-148 cdh-shell-bak]# kinit fayson
Password for [email protected]: 
[root@ip-172-31-6-148 cdh-shell-bak]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: [email protected]

Valid starting     Expires            Service principal
09/05/17 17:19:08  09/06/17 17:19:08  krbtgt/[email protected]
        renew until 09/12/17 17:19:08
[root@ip-172-31-6-148 cdh-shell-bak]# 

3.运行MapReduce作业

[root@ip-172-31-6-148~]# hadoop jar /opt/cloudera/parcels/CDH/lib/hadoop-0.20-mapreduce/hadoop-examples.jar pi 10 1
...
Starting Job
17/09/02 20:10:43 INFO mapreduce.Job: Running job: job_1504383005209_0001
17/09/02 20:10:56 INFO mapreduce.Job: Job job_1504383005209_0001 running in ubermode : false
17/09/02 20:10:56 INFO mapreduce.Job:  map0% reduce 0%
17/09/02 20:11:09 INFO mapreduce.Job:  map20% reduce 0%
17/09/02 20:11:12 INFO mapreduce.Job:  map40% reduce 0%
17/09/02 20:11:13 INFO mapreduce.Job:  map50% reduce 0%
17/09/02 20:11:15 INFO mapreduce.Job:  map60% reduce 0%
17/09/02 20:11:16 INFO mapreduce.Job:  map70% reduce 0%
17/09/02 20:11:19 INFO mapreduce.Job:  map80% reduce 0%
17/09/02 20:11:21 INFO mapreduce.Job:  map100% reduce 0%
17/09/02 20:11:26 INFO mapreduce.Job:  map100% reduce 100%
17/09/02 20:11:26 INFO mapreduce.Job: Job job_1504383005209_0001 completedsuccessfully

参考：
https://mp.weixin.qq.com/s?__biz=MzI4OTY3MTUyNg==&mid=2247484735&idx=1&sn=b021eb28562d566b5d3c97f3d4024905&chksm=ec2ad536db5d5c2017b61638eeb3bbc5640cff080e2a376923f3cb06ba4e57211fee4fc027e8&scene=21#wechat_redirect
https://blog.csdn.net/DF_XIAO/article/details/52838648
http://www.aboutyun.com/forum.php?mod=viewthread&tid=22835